CVE-2004-1288

Experiment Environment

CentOS 6.4 / Ubuntu 14.04

INSTALL & Configuration

wget https://github.com/mudongliang/source-packages/raw/master/CVE-2004-1288/o3read-0.0.3.tar.gz

tar -xvf o3read-0.0.3.tar.gz
cd o3read-0.0.3

make

Problems in Installation & Configuration

How to trigger vulnerability

./o3read-0.0.3/o3read < exp.xml

PoCs

o3read

Vulnerability Details & Patch

Root Cause

o3read.c:353

                                t[m++] = c;

Stack Trace

#0  __strlen_ia32 () at ../sysdeps/i386/i586/strlen.S:99
#1  0x0016623f in _IO_vfprintf_internal (s=0xfbad2088, format=<value optimized out>, ap=<value optimized out>)
    at vfprintf.c:1641
#2  0x0016d210 in __printf (format=0x8049246 "Tag: '%s'\n") at printf.c:35
#3  0x08049083 in dump_html (h=0x2b5440, i=0) at o3read.c:118
#4  0x08048765 in main (argc=134514489, argv=0x2b5440) at main.c:45

References